CVE-2018-25333 HIGH

CVE-2018-25333: Nordex N149/4.0-4.5 Wind Turbine Web Server SQL Injection

Vendor Nordex-Online
Product N149 Wind Turbine Web Server
Weakness CWE-89 · SQLi
Published May 17, 2026
Last update May 26, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Nordex N149/4.0-4.5 Wind Turbine Web Server 4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the login parameter in login.php. Attackers can submit crafted POST requests with SQL injection payloads in the login field to extract sensitive database information and bypass authentication mechanisms.

Key dates

02Disclosure timeline

May 17, 2026 CVE published
May 26, 2026 Record updated